Ves tige (véŝ tĭj) n. 1. A visible trace, evidence or sign of something that has once existed but now no longer exists or appears.

Transcription

1 Ves tige (véŝ tĭj) n. 1. A visible trace, evidence or sign of something that has once existed but now no longer exists or appears.

2 Obtaining & Using Social Media Evidence Using Social Media to Make Your Case June 7, 2018

3 Overview Define Social Media Differences to Traditional Digital Forensics What You Need to Know Q&A

4 Intro to Social Media

5 Definition The use of web-based and mobile technologies that enable people to communicate easily via the Internet to share information and resources.

6 Popular Social Media Sites

7 Unique Visits in Millions

8 The Big Billion Unique Users Monthly Visitors 467 Million Accounts 330 Million average monthly active accounts

9 A Comparison Social Media v Traditional Digital Forensics

10 Traditional Digital Forensics Approach

11 98% Rule On Display Written to Device Artifact & Other Never Displayed 110% Rule?

12 Correspondence Memos s Instant messages Faxes Deleted Old and forgotten

13 Business Records Financial data Assets Calculations PRIOR DRAFTS DELETED DRAFTS Projections Everything you could imagine

14 Every Website visited All pictures from those websites Every Website from popups and popunders All maps, from Mapquest for example

15 Every INTERNET SEARCH And Search Results

16 What you can expect Conceptual Analysis How the computer was used IMs s Web-based s Deletion activity Wiping activity Software installed File Transfers CD/DVD burning Attached hardware Other networks attached Remote Access activity Do we have the Right system?

17 Acquisition Completeness The Whole Truth Used & Unused (Unallocated) Space Active & Inactive Systems Seemingly Inaccessible Systems & Media

18 Acquisition Methodology Forensically-sound Bit-for-Bit Clone Copy, clone, mirror Write-protect Place on Sterile Media MD5 or other authentication hash Chain of Custody Seal Evidence

19 Authentication Authenticate: Prove no change Prove Clones ARE the Same Method MD5 Hash (digital fingerprint) Industry-standard, industry-recognized 128-bit 1 in 1x10 38 chance for deceiving 8 times more likely to win Missouri Powerball (1 in 120,000,000) 1 in 700,000 chance of being struck by lightning

20 Authenticate Our Methodology MD5 Hash Digital Fingerprint MD f9ebd7478f bab050ed6b4612f0

21 Authenticate Prove copies (working) are the same COPY f9ebd7478fbab050ed6b4612f f9ebd7478fbab050ed6b4612f0

22 Authenticate Prove nothing has changed f9ebd7478fbab050ed6b4612f f9ebd7478fbab050ed6b4612f0

23 There is a difference Comparing Social Media to Traditional Digital Forensics

24 Best Source Traditional: Interacting Device Clone Social Media: Service Provider Subpoena/Search Warrant Account information IP address Activity conducted Referer information

25 Thoroughness Traditional: Cloning w/ Hashing Social Media: Use of APIs At mercy of service provider, as APIs only expose what the provider wants exposed Public / Private Views May need to be part of the individual s social circle to see everything

26 Dynamic Traditional: Slow-changing. Snapshot today likely captures everything Social Media: Changes by the minute Implication constant capturing/monitoring

27 Deleted Information Traditional: Relatively Easy Social Media: Difficult, if not impossible

28 What you Need to Know

29 Categorical Evidence Social Footprint Connections Communication Pattern who & when Pix & Vids Uploaded? Tagged within? Times of Activity When event occurred Apps Which? Purpose? Inferences?

30 Uses Background checks Impeach witness Determine position or acknowledgment of fact/circumstance Proof of association between individuals Evidence of intent, predisposition or motive Physical location alibi Locating assets Establish habits/routines

31 Facebook

32 Evidence Available on Device JSON snippets Cached pictures Some activity timelines Memory remnants

33 Evidence Available Online Public Profile Private Profile (i.e. friend or via credentials) Posts Messages User Information Friends / network Albums News Feed Wall Groups Videos Links

34 Evidence Available from Facebook Subpoena / Search Warrant Required Specific Post Information Specific Metadata Associated with Item URI, fb_item_type, parent_itemnum, thread_id, album_id, post_id, etc Temporal Data created_time, updated_time Ownership Data User_id, user_img, TO, to_id Other probative information Application used to post to facebook (i.e. iphone, social media client, web-site, etc.)

35 Evidence Available from Facebook Subpoena / Search Warrant Required Basic Subscriber Information (Neoselect) User Identification Number (FaceBook ID) address Date & Timestamp of account creation date Most Recent Logins Registered Mobile number Expanded Subscriber Information (Neoprint) Profile Contact information Mini-feed Status Update History Shares Notes Wall Postings Friend Listing with Friends Facebook IDs Groups Listing with Facebook Group IDs Future and Past Events Video Listing, with filename

36 Evidence Available from Facebook Subpoena/Search Warrant Required User Photos Group Information Private Messages IP Logs Limited & can be incomplete

37 fax: mail: Facebook, Inc ATTN: Security Department/Custodian of Records 1601 California Ave Palo Alto, CA NOTE: Facebook does notify end-user that their information is being requested. Facebook does not accept legal process for Facebook.com must be Facebook, Inc.

38 LinkedIn

39 Evidence Available on Device JSON snippets Cached pictures Some activity timelines Memory remnants

40 Evidence Available Online Public Profile Private Profile (i.e. friend or via credentials) Statuses Network Updates Connections Profile Group Information & Discussions

41 Evidence Available from LinkedIn Subpoena / Search Warrant Required Basic Subscriber Information Member Identification Number (LinkedIn ID) address Date & Timestamp of account creation date Billing Information Snapshot of Member Profile Page Profile Summary Experience Education Recommendations Groups Network Update Stream User Profile photo IP Logs IP Address Data Account Visited Quantity of visits from that IP address

42 fax: mail: LinkedIn Corporation ATTN: Legal Department 2029 Stierlin Court Mountain View, CA NOTE: LinkedIn does notify end-user that their information is being requested.

43 Twitter

44 Anatomy of a Tweet Twitter Mathematics OR When is 280 characters not 280 characters? This message is 280 characters long. It is a demonstration to show the amount of data that can exist within a single Tweet. Short & Sweet! The preceding exclamation point is the old limit of 140 characters. Currently Tweets may contain 280 characters giving you more to play with

45 Anatomy of a Tweet Unique Tweet ID Screen name of user ID of reply Author s user name Author s screen name Author s location (free-form) Author s biography Creation date of account Timezone Number of users author is following Number of favorites this user has User s language Number of followers this user has Geolocation Info Application that sent the Tweet And probably more

46 Evidence Available on Device JSON snippets Memory remnants Tweet contents itself

47 Evidence Available Online Public Profile / Private* -- Blurred Timeline Mentions Messages Favorites My Tweets* Followers / Followees Web-pages linked in Tweets YouTube video links found in Tweets Library of Congress Archival Project

48 Evidence Available from Twitter Subpoena / Search Warrant Required Twitter Account Information Account Profile Profile Photo Header Photo Background Image Location (self-completed) URL Bio Status Updates (Tweets) IP Logs NOTE: Twitter does not require real name use, verification or any identity authentication.

49 fax: (attn: Trust & Safety Legal Policy) mail: Twitter, Inc c/o Trust & Safety Legal Policy 1355 Market St., Ste. 900 San Francisco, CA NOTE: Information above is for Law Enforcement Twitter does notify end-user that their information is being requested.

50 Final Considerations Legal & Privacy Issues

51 Legal Issues Authentication FRE 901(a) must offer evidence sufficient to support a finding that the matter in question is what its proponent claims FRE 901(b)(4) can authenticate ESI with circumstantial evidence, reflecting: contents, substance, internal patterns or other distinctive characteristics Court rulings: Metadata supports this

52 Legal Issues Enter FRE 902 (13) & 902 (14) December 1, 2017 (13) Certified Records Generated by an Electronic Process or System (14) Certified Data Copied from an Electronic Device, Storage Medium, or File.

53 Legal Issues FRE 902(13) Certified Records Generated by an Electronic Process or System. A record generated by an electronic process or system that produces an accurate result, as shown by a certification of a qualified person that complies with the certification requirements of Rule 902(11) or (12). The proponent must also meet the notice requirements of Rule 902(11).

54 Legal Issues FRE 902 (14) Certified Data Copied from an Electronic Device, Storage Medium, or File. Data copied from an electronic device, storage medium, or file, if authenticated by a process of digital identification, as shown by a certification of a qualified person that complies with the certification requirements of Rule 902(11) or (12). The proponent also must meet the notice requirements of Rule 902(11).

55 FRE 902(14) Certification Doesn t necessarily require producing a witness Certification from a person with knowledge that the evidence is authentic Use of hash values (colloquially digital fingerprint )

56 FRE 902(14) Under the new Rule 902(14) self-authentication of ESI is permitted with a certification from a qualified person that the hash value of evidence was checked against the original and it was identical f9ebd7478fba b050ed6b4612f f9ebd7478fba b050ed6b4612f0

57 FRE 902(14) The Committee also made clear that even though ESI is self authenticating, it still remains susceptible to other evidentiary objections such as hearsay and relevance.

58

59

60 Legal Issues Authentication State of Connecticut v Eleck (2011 WL (Conn.App. 2011)) Rejected printouts of FaceBook pages incumbent on the party seeking to admit the social media data to offer detailed circumstantial evidence that tends to authenticate the unique medium of social media. State v Tienda (5358 S.W.3d 633 (Tx.App.2012)) Prosecution successfully admitted key MySpace evidence over defendant s objection based upon circumstantial evidence, including: Relevant Metadata Fields Other MySpace pages of same defendant, User of same username, nickname and addresses User ID Stated location, Communications with other suspects and Posted photos with associated date and time stamps

61 Privacy Issues Public vs Private Profiles Public: None Private: How do you get to the data? Friend request? Ethical Rules vary lots of contradiction and confusion Ohio s Model Rule of Professional Conduct would seem to prohibit this.

62 Privacy Issues Provider s Privacy Settings Change FaceBook is notorious for this What expectation of privacy does the individual have? What historical record exists showing that the information was once protected but a change in the provider s settings have made it available? What affect will Cambridge Analytica have?

63 Approach Needs to incorporate: Authentication / Admissibility Privacy Concerns Technical Issues Identification of Appropriate Source for Collecting the Data

64 Closing Thoughts: What to do when faced with Electronic Data Involve Digital Forensic Expert early Ability to plan discovery strategy Ensure admissibility Work closely with client

65 And the number 1 reason If you think hiring an Expert is expensive wait until you ve hired an amateur!

66 Vestige Digital Investigations Electronic Evidence Experts We Turn Digital Evidence into Intelligence TM Digital Forensics CyberSecurity ESI Discovery Services Damon S. Hacker, MBA, CCE, CISA, CFSX Cleveland Columbus Pittsburgh